大模型
arxiv.org ·
你的模型正在泄露：通过 LLM 残差流的隐蔽信息传输
该 arXiv 预印本提出一种残差流隐蔽信道攻击：被入侵的运行时 hook 将消息映射为码字并注入中间残差流，注入强度按信噪比随局部残差范数缩放，离线观察者可用简单线性解码器恢复信息。攻击无需重训练、修改权重、攻击者控制的出网通道或对记录/传输过程的控制。在 7 个架构家族共 11 个模型上评估，9 个模型恢复率达 91–100%，KL 散度 0.001–0.007，而所评估的激活级检测器接近随机猜测。
AI推荐理由 arXiv 预印本，摘要给出了明确的方法与量化结果：通过被入侵的运行时 hook 将消息编码注入中间残差流，用线性解码器离线恢复；在 7 个架构家族 11 个模型上评估，9 个模型恢复率 91–100%，KL 散度 0.001–0.007，而激活级检测器接近随机猜测。新信息是提出残差流隐蔽信道攻击并给出跨模型可恢复性证据，对隔离/气隙环境下的 LLM 部署安全有直接参考价值。局限：仅为预印本，未提供同行评审、代码或完整检测器 AUC 数值，攻击前提是运行时组件已被入侵。
78
正文
Computer Science > Cryptography and Security
arXiv:2609.27996 (cs)
[Submitted on 23 Sep 2026]
Title:Your Model Is Leaking: Covert Information Transfer through LLM Residual Streams
Authors:Mingyuan Li, Yanna Jiang, Guangsheng Yu, Qin Wang, Xu Wang, Wei Ni, Ren Ping Liu
View a PDF of the paper titled Your Model Is Leaking: Covert Information Transfer through LLM Residual Streams, by Mingyuan Li and 6 other authors
View PDF
HTML (experimental)
Abstract:Privacy-sensitive organizations may run large language models (LLMs) in restricted or air-gapped environments while exporting selected diagnostic artifacts. We show that a compromised runtime component can hide sensitive information in intermediate activations that are allowed to leave the restricted environment. An offline observer can recover this information with a simple linear decoder. The attack requires no model retraining or weight modification, no attacker-controlled egress, and no control over the recorder or transfer process. We introduce a residual-stream covert-channel attack that maps messages to codewords and injects them into an intermediate residual stream through a compromised runtime hook. To maintain recoverability, the injection strength is scaled with the local residual norm using the signal-to-residual-norm ratio. Across eleven models from seven architecture families, our evaluation shows 91--100% recovery on nine models with KL divergence 0.001--0.007, while evaluated activation-level detectors remain close to random guessing (AUC
new
|
recent
| 2026-09
Change to browse by:
cs
References & Citations
NASA ADS
Google Scholar
Semantic Scholar
export BibTeX citation
Loading...
BibTeX formatted citation
×
loading...
Data provided by:
Bookmark
Bibliographic Tools
Bibliographic and Citation Tools
Bibliographic Explorer Toggle
Bibliographic Explorer (What is the Explorer?)
Connected Papers Toggle
Connected Papers (What is Connected Papers?)
Litmaps Toggle
Litmaps (What is Litmaps?)
scite.ai Toggle
scite Smart Citations (What are Smart Citations?)
Code, Data, Media
Code, Data and Media Associated with this Article
alphaXiv Toggle
alphaXiv (What is alphaXiv?)
Links to Code Toggle
CatalyzeX Code Finder for Papers (What is CatalyzeX?)
DagsHub Toggle
DagsHub (What is DagsHub?)
GotitPub Toggle
Gotit.pub (What is GotitPub?)
Huggingface Toggle
Hugging Face (What is Huggingface?)
ScienceCast Toggle
ScienceCast (What is ScienceCast?)
Demos
Demos
Replicate Toggle
Replicate (What is Replicate?)
Spaces Toggle
Hugging Face Spaces (What is Spaces?)
Spaces Toggle
TXYZ.AI (What is TXYZ.AI?)
Related Papers
Recommenders and Search Tools
Link to Influence Flower
Influence Flower (What are Influence Flowers?)
Core recommender toggle
CORE Recommender (What is CORE?)
Author
Venue
Institution
Topic
About arXivLabs
arXivLabs: experimental projects with community collaborators
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Which authors of this paper are endorsers? |
Disable MathJax (What is MathJax?)